This is a note to let you know that I've just added the patch titled
cgroup: fix locking in cgroup_cfts_commit()
to the 3.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
cgroup-fix-locking-in-cgroup_cfts_commit.patch
and it can be found in the queue-3.13 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 48573a893303986e3b0b2974d6fb11f3d1bb7064 Mon Sep 17 00:00:00 2001
From: Tejun Heo <tj@xxxxxxxxxx>
Date: Sat, 8 Feb 2014 10:26:34 -0500
Subject: cgroup: fix locking in cgroup_cfts_commit()
From: Tejun Heo <tj@xxxxxxxxxx>
commit 48573a893303986e3b0b2974d6fb11f3d1bb7064 upstream.
cgroup_cfts_commit() walks the cgroup hierarchy that the target
subsystem is attached to and tries to apply the file changes. Due to
the convolution with inode locking, it can't keep cgroup_mutex locked
while iterating. It currently holds only RCU read lock around the
actual iteration and then pins the found cgroup using dget().
Unfortunately, this is incorrect. Although the iteration does check
cgroup_is_dead() before invoking dget(), there's nothing which
prevents the dentry from going away inbetween. Note that this is
different from the usual css iterations where css_tryget() is used to
pin the css - css_tryget() tests whether the css can be pinned and
fails if not.
The problem can be solved by simply holding cgroup_mutex instead of
RCU read lock around the iteration, which actually reduces LOC.
Signed-off-by: Tejun Heo <tj@xxxxxxxxxx>
Acked-by: Li Zefan <lizefan@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
kernel/cgroup.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2845,10 +2845,7 @@ static int cgroup_cfts_commit(struct cft
*/
update_before = cgroup_serial_nr_next;
- mutex_unlock(&cgroup_mutex);
-
/* add/rm files for all cgroups created before */
- rcu_read_lock();
css_for_each_descendant_pre(css, cgroup_css(root, ss)) {
struct cgroup *cgrp = css->cgroup;
@@ -2857,23 +2854,19 @@ static int cgroup_cfts_commit(struct cft
inode = cgrp->dentry->d_inode;
dget(cgrp->dentry);
- rcu_read_unlock();
-
dput(prev);
prev = cgrp->dentry;
+ mutex_unlock(&cgroup_mutex);
mutex_lock(&inode->i_mutex);
mutex_lock(&cgroup_mutex);
if (cgrp->serial_nr < update_before && !cgroup_is_dead(cgrp))
ret = cgroup_addrm_files(cgrp, cfts, is_add);
- mutex_unlock(&cgroup_mutex);
mutex_unlock(&inode->i_mutex);
-
- rcu_read_lock();
if (ret)
break;
}
- rcu_read_unlock();
+ mutex_unlock(&cgroup_mutex);
dput(prev);
deactivate_super(sb);
return ret;
Patches currently in stable-queue which might be from tj@xxxxxxxxxx are
queue-3.13/cgroup-use-an-ordered-workqueue-for-cgroup-destruction.patch
queue-3.13/cgroup-update-cgroup_enable_task_cg_lists-to-grab-siglock.patch
queue-3.13/cgroup-fix-error-return-from-cgroup_create.patch
queue-3.13/cgroup-fix-error-return-value-in-cgroup_mount.patch
queue-3.13/cgroup-fix-locking-in-cgroup_cfts_commit.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html